forge/linux-uconsole
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions
linux-uconsole/drivers/net/wireless
History
Stanislaw Gruszka 4237cc8ef3 ath9k: protect tid->sched check 
[ Upstream commit 21f8aaee0c ]

We check tid->sched without a lock taken on ath_tx_aggr_sleep(). That
is race condition which can result of doing list_del(&tid->list) twice
(second time with poisoned list node) and cause crash like shown below:

[424271.637220] BUG: unable to handle kernel paging request at 00100104
[424271.637328] IP: [<f90fc072>] ath_tx_aggr_sleep+0x62/0xe0 [ath9k]
...
[424271.639953] Call Trace:
[424271.639998]  [<f90f6900>] ? ath9k_get_survey+0x110/0x110 [ath9k]
[424271.640083]  [<f90f6942>] ath9k_sta_notify+0x42/0x50 [ath9k]
[424271.640177]  [<f809cfef>] sta_ps_start+0x8f/0x1c0 [mac80211]
[424271.640258]  [<c10f730e>] ? free_compound_page+0x2e/0x40
[424271.640346]  [<f809e915>] ieee80211_rx_handlers+0x9d5/0x2340 [mac80211]
[424271.640437]  [<c112f048>] ? kmem_cache_free+0x1d8/0x1f0
[424271.640510]  [<c1345a84>] ? kfree_skbmem+0x34/0x90
[424271.640578]  [<c10fc23c>] ? put_page+0x2c/0x40
[424271.640640]  [<c1345a84>] ? kfree_skbmem+0x34/0x90
[424271.640706]  [<c1345a84>] ? kfree_skbmem+0x34/0x90
[424271.640787]  [<f809dde3>] ? ieee80211_rx_handlers_result+0x73/0x1d0 [mac80211]
[424271.640897]  [<f80a07a0>] ieee80211_prepare_and_rx_handle+0x520/0xad0 [mac80211]
[424271.641009]  [<f809e22d>] ? ieee80211_rx_handlers+0x2ed/0x2340 [mac80211]
[424271.641104]  [<c13846ce>] ? ip_output+0x7e/0xd0
[424271.641182]  [<f80a1057>] ieee80211_rx+0x307/0x7c0 [mac80211]
[424271.641266]  [<f90fa6ee>] ath_rx_tasklet+0x88e/0xf70 [ath9k]
[424271.641358]  [<f80a0f2c>] ? ieee80211_rx+0x1dc/0x7c0 [mac80211]
[424271.641445]  [<f90f82db>] ath9k_tasklet+0xcb/0x130 [ath9k]

Bug report:
https://bugzilla.kernel.org/show_bug.cgi?id=70551

Reported-and-tested-by: Max Sydorenko <maxim.stargazer@gmail.com>
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
[ xl: backported to 3.10: adjusted context ]
Signed-off-by: Xiangyu Lu <luxiangyu@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-06-07 13:25:40 -07:00
..
ath ath9k: protect tid->sched check 2014-06-07 13:25:40 -07:00
b43 b43: Fix machine check error due to improper access of B43_MMIO_PSM_PHY_HDR 2014-05-13 13:59:43 +02:00
b43legacy b43legacy: Fix unload oops if firmware is not available 2014-02-06 11:08:14 -08:00
brcm80211 brcmsmac: fix deadlock on missing firmware 2014-06-07 13:25:34 -07:00
hostap Hostap: copying wrong data prism2_ioctl_giwaplist() 2013-08-29 09:47:38 -07:00
ipw2x00 ipw2x00: move to kstrto* functions 2013-04-10 14:10:34 -04:00
iwlegacy iwl4965: better skb management in rx path 2013-12-04 10:57:36 -08:00
iwlwifi iwlwifi: dvm: take mutex when sending SYNC BT config command 2014-05-13 13:59:43 +02:00
libertas libertas: potential oops in debugfs 2013-11-29 11:11:39 -08:00
libertas_tf mac80211: Use a cfg80211_chan_def in ieee80211_hw_conf_chan 2013-03-25 19:19:35 +01:00
mwifiex mwifiex: save and copy AP's VHT capability info correctly 2014-03-23 21:38:13 -07:00
orinoco Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2013-05-01 14:08:52 -07:00
p54 p54: clamp properly instead of just truncating 2014-03-31 09:58:13 -07:00
prism54 prism54: set netdev type to "wlan" 2013-12-04 10:57:05 -08:00
rt2x00 rt2x00: fix beaconing on USB 2014-06-07 13:25:33 -07:00
rtl818x rtl8187: fix regression on MIPS without coherent DMA 2014-03-06 21:30:02 -08:00
rtlwifi rtl8192cu: Fix unbalanced irq enable in error path of rtl92cu_hw_init() 2014-06-07 13:25:34 -07:00
ti wl12xx/wl18xx: scan all 5ghz channels 2013-06-12 10:20:57 -04:00
zd1211rw mac80211: Use a cfg80211_chan_def in ieee80211_hw_conf_chan 2013-03-25 19:19:35 +01:00
adm8211.c mac80211: Use a cfg80211_chan_def in ieee80211_hw_conf_chan 2013-03-25 19:19:35 +01:00
adm8211.h
airo.c airo: Use remove_proc_subtree() 2013-05-01 17:29:42 -04:00
airo.h
airo_cs.c
at76c50x-usb.c mac80211: Use a cfg80211_chan_def in ieee80211_hw_conf_chan 2013-03-25 19:19:35 +01:00
at76c50x-usb.h
atmel.c atmel: printing bogus information 2013-05-22 14:51:11 -04:00
atmel.h
atmel_cs.c
atmel_pci.c
Kconfig
mac80211_hwsim.c mac80211_hwsim: correctly register the platform driver 2013-05-16 22:38:02 +02:00
mac80211_hwsim.h
Makefile
mwl8k.c mwl8k: remove nonstandard rate 72 Mbps 2013-04-22 15:06:44 -04:00
ray_cs.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2013-05-01 17:51:54 -07:00
ray_cs.h
rayctl.h
rndis_wlan.c
wl3501.h
wl3501_cs.c
zd1201.c zd1201: do not use stack as URB transfer_buffer 2013-08-29 09:47:35 -07:00
zd1201.h